{"id":17786678,"url":"https://github.com/josh/systemd-age-creds","last_synced_at":"2025-08-13T01:33:23.736Z","repository":{"id":259090026,"uuid":"876290966","full_name":"josh/systemd-age-creds","owner":"josh","description":"Load age encrypted credentials in systemd units","archived":false,"fork":false,"pushed_at":"2024-10-24T00:50:06.000Z","size":62,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2024-10-24T15:28:51.544Z","etag":null,"topics":["age-encryption","nix","systemd","systemd-creds"],"latest_commit_sha":null,"homepage":"","language":"Nix","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/josh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-10-21T18:09:02.000Z","updated_at":"2024-10-24T00:50:10.000Z","dependencies_parsed_at":"2024-10-27T00:34:12.044Z","dependency_job_id":"bad37158-1e02-46b3-bfe5-49367eb19420","html_url":"https://github.com/josh/systemd-age-creds","commit_stats":null,"previous_names":["josh/systemd-age-creds"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josh%2Fsystemd-age-creds","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josh%2Fsystemd-age-creds/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josh%2Fsystemd-age-creds/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/josh%2Fsystemd-age-creds/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/josh","download_url":"https://codeload.github.com/josh/systemd-age-creds/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":229724349,"owners_count":18114429,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["age-encryption","nix","systemd","systemd-creds"],"created_at":"2024-10-27T10:04:22.093Z","updated_at":"2025-08-13T01:33:23.660Z","avatar_url":"https://github.com/josh.png","language":"Nix","funding_links":[],"categories":[],"sub_categories":[],"readme":"# systemd-age-creds\n\nLoad [age](https://github.com/FiloSottile/age) encrypted credentials in [systemd units](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html).\n\nAt the moment, [systemd-creds](https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.html) only support symmetric encryption requiring secrets to be encrypted on the machine with the TPM itself. Though, it's on the [systemd TODO](https://github.com/systemd/systemd/blob/e8fb0643c1bea626d5f5e880c3338f32705fd46d/TODO#L990-L1000) to add one day.\n\nSolutions like [SOPS](https://github.com/getsops/sops) allow secrets to be encrypted elsewhere, checked into git and then only decrypted on the deployment host. It would be nice if a similar pattern could be applied to [systemd credentials](https://systemd.io/CREDENTIALS/).\n\n`systemd-age-creds` provides a service credential server over `AF_UNIX` socket to provide [age](https://github.com/FiloSottile/age) encrypted credentials to [systemd units](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html) using `LoadCredential`.\n\n## Usage\n\n**systemd-age-creds.socket**\n\n```ini\n[Unit]\nDescription=age credential socket\n\n[Socket]\nListenStream=%t/systemd-age-creds.sock\nSocketMode=0600\nService=systemd-age-creds.service\n\n[Install]\nWantedBy=sockets.target\n```\n\n**systemd-age-creds.service**\n\n```ini\n[Unit]\nDescription=age credential server\nRequires=systemd-age-creds.socket\n# After=tpm\n\n[Service]\nType=simple\nExecStart=/path/to/bin/systemd-age-creds -i /path/to/age-key.txt /path/to/secrets\n```\n\n**foo.service**\n\n```ini\n[Service]\nExecStart=/usr/bin/myservice.sh\n# Instead of loading a symmetrically encrypted systemd cred from a file,\n# LoadCredentialEncrypted=foobar:/etc/credstore/myfoobarcredential.txt\n#\n# You can reference the credential id loading from the systemd-age-creds socket.\nLoadCredential=foobar:%t/systemd-age-creds.sock\n```\n\n### Nix\n\nThis project was originally written to meet the needs of [NixOS](https://nixos.org/) systems. However, nothing about the service itself is dependent on Nix. But if you are using NixOS, you can use this repository as a flake input to get access to NixOS modules that make defining the necessary system units easier.\n\n```nix\n{ config, inputs }: {\n  imports = [ inputs.systemd-age-creds.nixosModules.default ];\n\n  services.systemd-age-creds = {\n    enable = true;\n    identity = \"/path/to/age/key.txt\";\n    directory = ./path/to/secrets;\n  };\n\n  systemd.services.example = {\n    serviceConfig = {\n      LoadCredential = [\n        \"foobar:${config.services.systemd-age-creds.socket}\"\n      ];\n    };\n  };\n}\n```\n\n## See Also\n\n[systemd Credentials](https://systemd.io/CREDENTIALS/), [systemd-creds](https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.html), [age](https://github.com/FiloSottile/age), [age-plugin-tpm](https://github.com/Foxboron/age-plugin-tpm)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjosh%2Fsystemd-age-creds","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjosh%2Fsystemd-age-creds","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjosh%2Fsystemd-age-creds/lists"}